Technical Summary: Deployable AI for IoT/IIoT Security

Problem Statement

While Artificial Intelligence (AI) is increasingly applied to secure Internet of Things (IoT) and Industrial Internet of Things (IIoT) systems, a significant gap exists between benchmark performance and operational readiness. Current literature often reports high detection accuracy on curated datasets, yet these results frequently fail to translate to real-world deployments characterized by scarce or noisy labels, heterogeneous device fleets, concept drift, and strict constraints on latency, memory, and energy. Traditional security controls are often reactive and struggle with the volume and velocity of IoT telemetry. Furthermore, existing surveys tend to be fragmented by specific tasks (e.g., intrusion detection), paradigms (e.g., federated learning), or domains (e.g., healthcare), lacking an integrated view of how AI techniques map to security tasks under the specific constraints of deployability. The core problem addressed is the lack of evidence supporting the transition of AI-based security methods from isolated benchmark experiments to deployment-grade assurance in operational IoT/IIO environments.

Methodology

This study is a systematic literature review conducted in accordance with PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) principles.

• Corpus: The review synthesizes 154 peer-reviewed journal articles published between January 2021 and November 2025.
• Selection Criteria: Studies were restricted to Q1/Q2 journal articles to ensure mature, peer-reviewed evidence. Eligibility required the explicit application of AI or data-driven techniques to IoT/IIoT security problems with sufficient methodological and experimental detail. Conference papers, preprints, and non-AI studies were excluded.
• Search Strategy: Searches were performed across six databases (IEEE Xplore, ACM Digital Library, Scopus, Web of Science, ScienceDirect, SpringerLink) using a combination of IoT/IIoT context terms, security objective terms, and AI technique terms. Additional records were identified through citation chaining and manual journal checks.
• Quality Assessment: A structured eight-criterion rubric was applied to all 154 studies, scoring problem definition, dataset transparency, evaluation protocols, baselines, metric reporting, reproducibility, limitations, and deployability evidence. Studies were classified as high, medium, or low quality based on scores ranging from 0 to 16.
• Synthesis: The analysis combined descriptive quantitative coding (distribution of AI families, tasks, datasets, metrics) with critical narrative interpretation focused on operational constraints: labeling burden, cross-context transfer, resource feasibility, and explainability.

Key Contributions

1. Unified Taxonomy: The paper develops a taxonomy linking AI technique families (e.g., classical ML, deep learning, federated learning) to specific IoT/IIoT security functions (e.g., intrusion detection, anomaly detection, device authentication).
2. Evidence Mapping: It maps the distribution of research, identifying dominant concentrations in detection tasks and underexplored operational areas such as identity assurance, insider threat detection, and root-cause localization.
3. Deployment-Oriented Evaluation: Rather than focusing solely on accuracy, the review evaluates evidence based on operational constraints, including dataset realism, validation protocols (e.g., scenario-disjoint vs. random splits), and the reporting of runtime costs and robustness.
4. Maturity Agenda: The authors propose an actionable agenda for achieving deployable AI, emphasizing the need for standardized "train-here-deploy-there" protocols, drift-aware validation, and explainability validated with operational users.

Key Results

• Publication Trends: Research volume expanded rapidly after 2022, with the highest concentration in 2024. The field is shifting from proof-of-concept studies toward methodological diversification, including federated learning and adversarial robustness.
• AI Technique Distribution: The corpus is dominated by three families: Classical Machine Learning (39.6%), Federated/Split/Swarm Learning (15.6%), and Deep Learning (14.3%). Together, these account for nearly 70% of the studies.
• Task Imbalance: Research is heavily concentrated on Intrusion Detection (31.2%) and Anomaly Detection (18.2%), totaling 49.4% of the corpus. Critical operational functions like authentication (1.3%), insider threat detection (1.3%), and threat response (2.6%) remain significantly underexplored.
• Dataset and Validation Issues: The review highlights that performance claims are often inflated by the use of non-IoT-native datasets (e.g., NSL-KDD) or random flow-level splits that leak data between training and testing. Stronger evidence is found in studies using scenario-disjoint, device-disjoint, or time-aware validation protocols.
• Quality and Deployability: While a substantial portion of the literature (62 high-quality, 73 medium-quality studies) provides useful evidence, deployment readiness remains uneven. Many studies lack evidence regarding robustness to distribution shifts, resource constraints, and explainability for human operators.

Significance and Claims

The paper argues that deployment maturity cannot be inferred from benchmark accuracy alone. High detection rates on static datasets do not guarantee operational reliability in dynamic IoT/IIoT environments. The significance of this work lies in shifting the evaluation paradigm from "benchmark-centered performance reporting" to "deployment-grade assurance."

The authors identify four recurring operational pillars that determine deployability:

1. Labeling Burden: The gap between curated benchmark labels and the expensive, delayed, or ambiguous ground truth in operations.
2. Transfer Under Domain Shift: The necessity of validating models across different device fleets, firmware versions, and network topologies, rather than assuming static performance.
3. Resource and Real-Time Feasibility: The need to evaluate end-to-end system properties (latency, energy, memory) rather than just model inference speed.
4. Explainability and Governance Readiness: The requirement for explanations that support analyst triage, root-cause analysis, and auditability, rather than serving as cosmetic features.

The review concludes that for AI to become a maintainable security capability in IoT/IIoT, future research must prioritize evidence frameworks that test label sustainability, transferability, drift handling, and governance alignment, moving beyond isolated model performance to holistic security workflow integration.